Turla Cereal malware copied government emails to Moscow

What is Cereal malware?

ESET named the toolkit Cereal. Its key part, CerealBox, hides inside the process that handles mail flow on Exchange. It does not install a visible new service. It hooks into existing Exchange mechanisms, so the original message still reaches its recipient.

It is also picky. CerealBox only looks at emails with DOC, DOCX or PDF attachments, then checks senders, recipients, subjects and file names. Only matching messages are packed, encrypted and left for the operators to collect.

In Romania, where the same toolkit was used on 23 December 2025, the setup searched for correspondence with addresses tied to NATO and EU institutions. That does not mean NATO or the European Commission were breached. The victim was an organisation that wrote to them. ESET has not named the Romanian body, the content of the stolen mail, or how much data was taken.

No server of their own

Most spyware phones home to attacker-controlled servers, which can give it away. Here, a module called CerealNeuron sat on the infected Exchange server and waited for specially crafted web requests that looked like ordinary mail traffic. Commands arrived through the victim's own infrastructure. The code also ran largely in memory, leaving fewer traces on disk, and ESET notes advanced use of .NET that requires deep knowledge of Exchange internals.

The attribution rests on earlier known Turla tools and technical similarities, not on identifying individual operators. Turla has been active since at least 2004. In 2023 the FBI disrupted its Snake spyware in Operation Medusa. ESET says about 70 percent of the countries the group has targeted since 2022 were former Soviet republics or European states historically tied to the USSR. How the attackers first got in is unknown.